3 ms·

Call me crazy but that is a real worry for me, and has been for a while. How long until we see some large corporate software have their deployment process hijac

Call me crazy but that is a real worry for me, and has been for a while. How long until we see some large corporate software have their deployment process hijacked, and have it affect a ton of computers that auto-update?

spydum 2y ago
I mean, isn't that roughly the solarwinds story? There is no real shortage of supply chain incidents in the last few years. The reality is we are all mostly okay with that tradeoff.
jen20 2y ago
Around -4 years? [1] [1]: https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...
alsodumb 2y ago
You mean like the SolarWinds hack that happened a lil while ago? https://www.techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-need-to-know https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...
btown 2y ago
One of the most dangerous versions of this IMO is someone who compromises a NPM/Pypi package that's widely used as a dependency. If you can make it so that the original developer doesn't know you've compromised their accounts (spear-phished SIM swap + email compromise while the target is traveling, for instance, or simply compromising the developer themselves), you don't need every downstream user to manually update - you just need enough projects that aren't properly configured with lockfiles, and you've got code execution on a huge number of servers. I'm hopeful that the fallout from Crowdstrike will be a larger emphasis on software BOM risk - when your systems regularly phone home for updates, you're at the mercy of the weakest link in that chain, and that applies to CI/CD and end user devices alike.
- IncreasePosts 2y ago
  It makes me wonder how many core software libraries to modern infrastructure could be compromised by merely threatening a single person.
  - jmb99 2y ago
    As always, a relevant xkcd[1]. I would not be surprised if the answer to “how many machines can be compromised in 24 hours by threatening one person” was less than 8 figures. If you can find the right person, probably 9+. [1] https://xkcd.com/2347/ https://xkcd.com/2347/
- leni536 2y ago
  Just compromise one popular vim plugin and you have dev access to half of the industry.

spydum 2y ago

I mean, isn't that roughly the solarwinds story? There is no real shortage of supply chain incidents in the last few years. The reality is we are all mostly okay with that tradeoff.

jen20 2y ago

Around -4 years? [1] [1]: https://en.wikipedia.org/wiki/2020_United_States_federal_government_data_breach https://en.wikipedia.org/wiki/2020_United_States_federal_gov...

alsodumb 2y ago

You mean like the SolarWinds hack that happened a lil while ago? https://www.techtarget.com/whatis/feature/SolarWinds-hack-explained-Everything-you-need-to-know https://www.techtarget.com/whatis/feature/SolarWinds-hack-ex...

btown 2y ago

One of the most dangerous versions of this IMO is someone who compromises a NPM/Pypi package that's widely used as a dependency. If you can make it so that the original developer doesn't know you've compromised their accounts (spear-phished SIM swap + email compromise while the target is traveling, for instance, or simply compromising the developer themselves), you don't need every downstream user to manually update - you just need enough projects that aren't properly configured with lockfiles, and you've got code execution on a huge number of servers. I'm hopeful that the fallout from Crowdstrike will be a larger emphasis on software BOM risk - when your systems regularly phone home for updates, you're at the mercy of the weakest link in that chain, and that applies to CI/CD and end user devices alike.

IncreasePosts 2y ago
It makes me wonder how many core software libraries to modern infrastructure could be compromised by merely threatening a single person.
- jmb99 2y ago
  As always, a relevant xkcd[1]. I would not be surprised if the answer to “how many machines can be compromised in 24 hours by threatening one person” was less than 8 figures. If you can find the right person, probably 9+. [1] https://xkcd.com/2347/ https://xkcd.com/2347/
leni536 2y ago
Just compromise one popular vim plugin and you have dev access to half of the industry.